Chapter 2. Understanding the Internals of iOS Devices

As of November 2015, Apple had sold more than 1 billion iOS devices according to released sales records, and these numbers are expected to grow. While iOS is the leading operating system for tablets worldwide, Android continues to be the leading operating system for smartphones worldwide. Regardless of the statistics, if you are a forensic examiner, the chances are you will need to conduct an examination of an iOS device.

In order to perform a forensic examination of an iOS device, the examiner must understand the internal components and inner workings of that device. Developing an understanding of the underlying components of a mobile device will help the forensic examiner understand the criticalities involved in the forensic process, including what data can be acquired, where the data is stored, and what methods can be used to access the data from that device. So, before we delve into the examination of iOS devices, it is necessary to know the different models that exist and their internal components. Throughout this book, we will perform forensic acquisition and analysis on iOS devices to include the iPhone, iPad, and Apple Watch.

The goal of this chapter is to introduce you to the iOS device technology. We will cover details that may often get overlooked, but will help you during your forensic investigation. You must understand the different iOS devices and how the data is stored on the devices before you can successfully extract it.

In this chapter, we will cover the following topics in detail: